Posts Tagged ‘emulator’

Argos 0.4.1 released

Thursday, May 22nd, 2008

The new version of Argos (0.4.1) contains bug fixes related with taint tracking. It is recommended to update to the latest version of Argos, since it solves issues with reported false positives. Checking the CALL instruction for tainted operands, has also been re-enabled, since it seems it does not cause problems with windows systems anymore. The use of a whitelist is not necessary as well, since the false positives reported by 2.6.* linux kernels are also solved. Finally, crashes reported with windows 2000 guest systems, seem to be also solved.

If any of the users discovers false positives, after these changes please notify the developers immediately. You can get argos from the VU gforge site.


Argos version 0.4.0 released

Friday, March 14th, 2008

Finally, the long awaited port to QEMU 0.9.* series is here. Argos v0.4.0 is based upon QEMU v0.9.1.

Some useful changes follow:

version 0.9.1:

  • TFTP booting from host directory (Anthony Liguori, Erwan Velu)
  • Tap device emulation for Solaris (Sittichai Palanisong)
  • Monitor multiplexing to several I/O channels (Jason Wessel)
  • CPU model selection support (J. Mayer, Paul Brook, Herve Poussineau)
  • Read-only support for Parallels disk images (Alex Beregszaszi)
  • SVM (x86 virtualization) support (Alexander Graf)
  • Intel mainstone II board emulation (Armin Kuster)
  • VMware SVGA II graphics card support (Andrzej Zaborowski)

version 0.9.0:

  • Support for relative paths in backing files for disk images
  • Async file I/O API
  • New qcow2 disk image format
  • Support of multiple VM snapshots
  • Linux: specific host CDROM and floppy support
  • SMM support
  • Moved PCI init, MP table init and ACPI table init to Bochs BIOS
  • several x86 and x86_64 emulation fixes
  • Mouse relative offset VNC extension (Anthony Liguori)
  • PXE boot support (Anthony Liguori)
  • ‘-daemonize’ option (Anthony Liguori)

Additional changes, besides the port, include a double taintness check before executing a part of code to ensure attackers’ injected code is always detected at the moment it is first executed. The check is performed whenever a TB is scheduled to be executed, as well as within the translated code whenever EIP is modified. This is to cover TB chaining performed by QEMU to speed up emulation. In the future we might consider disabling chaining, if a single check offers a significant performance gain.

For more information on Argos visit: